CWE-348Use of Less Trusted Source

Abstraction: Base · CVEs in our corpus: 66

The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Last updated: 22 August 2026 14:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 8 mapping(s) from 5 framework(s): CAPEC 4 (partial) · STIG oracle linux 8 1 (mostly) · STIG oracle linux 9 1 (mostly) · STIG rhel 7 1 (mostly) · ATT&CK 1 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
ID.RA-09
PR.DS-02
AC-4 Information Flow Enforcement

Detect

Catch it (CSF Detect / Respond)

DE.AE-03

Harden

Shrink the surface (DISA STIG)

7 hardening rules · 4 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control	Title	Family	Why it addresses this CWE
`SC-21`	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	SC	Prevents use of less-trusted or adversarial sources by requiring proof of origin and integrity before accepting responses.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1557.002 ARP Cache Poisoning←P →M

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2022-31813`	7.8	9.8	0.0335	2022-06-09
`CVE-2024-45410`	7.6	9.8	0.0150	2024-09-19
`CVE-2025-59951`	7.5	9.1	0.0465	2025-10-01
`CVE-2026-44183`	7.1	9.8	0.0022	2026-05-12
`CVE-2026-48772`	7.1	10.0	0.0021	2026-06-19
`CVE-2025-48865`	6.9	9.1	0.0050	2025-05-30
`CVE-2026-58122`	6.8	9.1	0.0029	2026-07-09
`CVE-2024-27773`	6.5	8.8	0.0036	2024-03-18
`CVE-2025-69240`	6.3	8.8	0.0015	2026-03-16
`CVE-2021-21374`	6.1	8.1	0.0104	2021-03-26
`CVE-2024-47880`	6.1	8.1	0.0035	2024-10-24
`CVE-2026-12249`	6.1	9.0	0.0014	2026-06-22
`CVE-2026-55641`	6.1	8.2	0.0025	2026-07-10
`CVE-2022-2255`	6.0	7.5	0.0088	2022-08-25
`CVE-2025-55292`	6.0	8.2	0.0013	2026-01-28
`CVE-2026-9561`	6.0	8.2	0.0019	2026-07-14
`CVE-2026-46415`	6.0	8.2	0.0016	2026-07-20
`CVE-2021-21373`	5.7	7.5	0.0115	2021-03-26
`CVE-2024-23105`	5.7	7.5	0.0044	2024-05-14
`CVE-2026-43634`	5.7	7.5	0.0024	2026-05-19
`CVE-2026-63770`	5.7	7.5	0.0020	2026-07-20
`CVE-2026-64619`	5.7	7.5	0.0020	2026-07-20
`CVE-2025-27913`	5.6	7.5	0.0018	2025-03-10
`CVE-2026-35391`	5.6	7.5	0.0014	2026-04-06
`CVE-2025-47424`	5.2	7.1	0.0015	2025-05-09